Deployment Architecture

Making search head clustering

graju89
Path Finder

Hi,

I need step to step process of adding new search head into my splunk instances. My splunk setup as follows:
1. one search head
2. one deployment server
3. three search peers.

So i am adding another search head that means I have ti create a search head cluster and do the configuration. Can any one help me with the complete step?

Thanks.

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You must have at least three search heads to create a search head cluster (SHC). You will also need a search head deployer, which possibly can be done by your deployment server.

However, just because you have more than one search head does not mean you need a SHC. You can have two independent search heads, but they won't share capacity and will be harder to manage.

If you still want an SHC, Splunk docs explain how to do it at https://docs.splunk.com/Documentation/Splunk/7.2.4/DistSearch/SHCdeploymentoverview.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

RohitMu
Explorer
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You must have at least three search heads to create a search head cluster (SHC). You will also need a search head deployer, which possibly can be done by your deployment server.

However, just because you have more than one search head does not mean you need a SHC. You can have two independent search heads, but they won't share capacity and will be harder to manage.

If you still want an SHC, Splunk docs explain how to do it at https://docs.splunk.com/Documentation/Splunk/7.2.4/DistSearch/SHCdeploymentoverview.

---
If this reply helps you, Karma would be appreciated.

graju89
Path Finder

@richgalloway Hi, I will have only two search head. Don't I need SHC?

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Not with two search heads, no. Quoting from System requirements and other deployment considerations for search head clusters:

The cluster must contain at a minimum the number of members needed to fulfill both of these requirements:

For example, if your replication factor is either 2 or 3, you need at least three instances.

0 Karma

graju89
Path Finder

@ChrisG Thank you so much.

0 Karma

graju89
Path Finder

@ChrisG @richgalloway I am having trouble in finding the security key when adding the new search head into the cluster. Do you know where I can or how I can get the security key when adding the new search head into clustering.

Thanks,

0 Karma

sloshburch
Splunk Employee
Splunk Employee

I think you are refering to the pass4SymmKey. Review to Set up the deployer

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Have you read the docs already? There is extensive information about search head clustering, starting with About search head clustering in the Distributed Search manual. See also Search head clustering architecture and Deploy a search head cluster, among many other topics in that manual.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...